Bulk SharePoint/M365 Export: Known Exfil IP or First-Seen Scripting UA
Detects bulk SharePoint/M365 file access or download either from a known UNC6671 exfiltration IP, or via a scripting-library user agent that is new for the user and exceeds a volume threshold within a short session window.
Microsoft Sentinel (KQL)
